Starstruk Logo MarkStarstruk

v1.10.2

langflow-ai/langflowv1.10.2Jul 7, 2026by github-actions[bot]

AI Summary

A security and Python 3.14 readiness release blocking dangerous MCP configurations, enforcing sandboxing, and preparing for Python 3.14 support.

Key Highlights

  • Block public builds of code execution agents
  • Gate litellm off Python 3.14 to ensure pip install resolves
  • Enforce FileSystem tool sandbox per authenticated user

New Features

  • Add global variable model overrides

Full Release Notes

<!-- Release notes generated using configuration in .github/release.yml at v1.10.2 -->

## What's Changed
### ✨ New Features
* feat: add global variable model overrides by @erichare in https://github.com/langflow-ai/langflow/pull/13935
### 🐛 Bug Fixes
* fix: use session exec in telemetry writer by @erichare in https://github.com/langflow-ai/langflow/pull/13821
* fix: disable mem0 telemetry by default by @erichare in https://github.com/langflow-ai/langflow/pull/13824
* fix: handle invalid session auth tokens by @erichare in https://github.com/langflow-ai/langflow/pull/13823
* fix: remove hardcoded default superuser password by @erichare in https://github.com/langflow-ai/langflow/pull/13822
* fix: isolate FAISS persistence by user by @erichare in https://github.com/langflow-ai/langflow/pull/13871
* fix: block public builds of code execution agents by @erichare in https://github.com/langflow-ai/langflow/pull/13875
* fix: validate file paths by resolved cache containment by @erichare in https://github.com/langflow-ai/langflow/pull/13872
* fix: restrict log retrieval to superusers by @erichare in https://github.com/langflow-ai/langflow/pull/13873
* fix: block dangerous MCP stdio env vars by @erichare in https://github.com/langflow-ai/langflow/pull/13874
* fix: Block Python interpreter format traversal by @erichare in https://github.com/langflow-ai/langflow/pull/13880
* fix: constrain Directory component paths by @erichare in https://github.com/langflow-ai/langflow/pull/13878
* fix(mcp): launch stdio servers with shell=False (no bash -c / cmd /c wrapper) by @erichare in https://github.com/langflow-ai/langflow/pull/13900
* fix: gate litellm off Python 3.14 so pip install langflow resolves by @erichare in https://github.com/langflow-ai/langflow/pull/13814
* fix: scope local vector store collections by user by @erichare in https://github.com/langflow-ai/langflow/pull/13882
* fix: cascade span deletes when clearing traces for a flow by @andifilhohub in https://github.com/langflow-ai/langflow/pull/13960
### ✅ Tests
* test(frontend): harden model dropdown footer clicks in select-gpt-model by @erichare in https://github.com/langflow-ai/langflow/pull/13936
### Others
* chore: upgrade lock files by @Adam-Aghili in https://github.com/langflow-ai/langflow/pull/13971


**Full Changelog**: https://github.com/langflow-ai/langflow/compare/v1.10.1...v1.10.2